# What the second Tea breach revealed about private messages

> Firsthand reporting found that anonymous usernames did not prevent identification through exposed conversations.

Source: https://fullbytedeveloper.com/blog/tea-app-message-breach-2025
Originally posted: 2025-07-26
Published here: 2026-11-06

On July 28, 2025, 404 Media reported a second security issue affecting Tea, the dating-safety app. Its reporters said they obtained more than one million private messages and verified findings supplied by an independent security researcher [1].

## The earlier exposure

On July 25, 404 Media reported an exposed Firebase database involving Tea users' selfies and identity documents. Its reporters reviewed screenshots, posts and code, and obtained a statement from Tea acknowledging a breach [2]. Our earlier Instagram post concerned that exposure.

## Why this was a separate incident

The report distinguished the message database from the earlier image breach. It said the messages included recent conversations, rather than only the older material described in Tea's initial statement [1].

That distinction matters during an incident: the dates and systems covered by an initial notice may not describe a later discovery.

## Anonymous names did not remove identifying details

The reporters said information inside messages made some users identifiable even though the app encouraged anonymous screen names [1]. There is no need to reproduce those conversations to explain the failure.

For developers, the lesson is to examine what a record contains, not just the name on the account. A private-message feature needs access controls that match its promise to users. Test those controls with accounts and data you own, including attempts to request another test user's messages.

This article describes the reported 2025 exposure. It does not provide access to leaked messages or claim to establish Tea's current security state.

## Sources

1. [404 Media: firsthand investigation of Tea message exposure](https://www.404media.co/a-second-tea-breach-reveals-users-dms-about-abortions-and-cheating/)
2. [404 Media: firsthand investigation of the initial Tea breach](https://www.404media.co/women-dating-safety-app-tea-breached-users-ids-posted-to-4chan/)

## Original posts

- [Instagram post](https://www.instagram.com/fullbytedeveloper/p/DM2lr60sYmd/)
- [Instagram post](https://www.instagram.com/fullbytedeveloper/p/DMlPISOs3BF/)